The competent supervisory authority shall approve binding corporate rules under the Article 63 consistency mechanism only where they are legally binding and enforced by every member of the group (including employees), expressly confer enforceable rights on data subjects, and fulfil the detailed requirements of paragraph 2. Controllers or processors established in the Union accept liability for breaches by members not established in the Union, except to the extent they prove non‑responsibility.

Paragraph 2 requires BCRs to specify at least: group structure and contacts; the transfers or sets of transfers (categories of personal data, processing types and purposes, affected data‑subject categories and third countries); their binding nature; application of general data‑protection principles (purpose limitation, data minimisation, storage limits, data quality, data protection by design and by default, legal basis, special‑category data, security and onward‑transfer safeguards); data‑subject rights including protection from solely automated decisions, complaint, redress and compensation; information provision beyond Articles 13 and 14; DPO or monitoring tasks, complaint procedures, verification mechanisms including audits, corrective actions and reporting to monitoring personnel and the board and availability to the supervisory authority; mechanisms for reporting and recording changes and notifying the authority; cooperation and reporting to the supervisory authority on third‑country legal requirements likely to affect guarantees; and appropriate staff training. The Commission may specify exchange formats and procedures by implementing acts adopted under the examination procedure of Article 93(2).